guloader | fd5b1720cd537115d86f9043376e29c63122d2fb6ed1faabb2e272f966849370

Analysis

max time kernel
135s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fd5b1720cd537115d86f9043376e29c63122d2fb6ed1faabb2e272f966849370.vbs
Size 847KB
Sample240820-cmplvasenk
SHA256 fd5b1720cd537115d86f9043376e29c63122d2fb6ed1faabb2e272f966849370
MD5 ac45bc078789f8e6a6b38306cf2afa6c
SHA1 567ea89339354e72870b3ee4939f4699731ae4a7
SHA512 e5f7ab1539c145e2d9840335dc4747d8f0e0a4d63c44b0be39c490b779e0527cb710af6046e365d2521d181a4a14cd14ce86613c4587c929c8c3318404d56b3d
SSDEEP 12288:m7i5unVo+IJTTA9lg7tPzjqPyMWq86AzyABdRJ/AzP:MLS+IBAYjqZWR6AeABdS
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

guloader discovery downloader

Malware Config

Signatures

Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
downloader guloader

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
2168	x.exe

Loads dropped DLL 2 IoCs

pid	Process
2168	x.exe
4500	x.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4500	x.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2168	x.exe
4500	x.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2168 set thread context of 4500	2168	x.exe	95

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Tobaksbrune221\forvredent.Pro	x.exe
File opened for modification	C:\Windows\resources\0409\overjump\brneopdragelserne.par	x.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	x.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4500	x.exe
4500	x.exe
4500	x.exe
4500	x.exe
4500	x.exe
4500	x.exe
4500	x.exe
4500	x.exe
4500	x.exe
4500	x.exe
4500	x.exe
4500	x.exe
4500	x.exe
4500	x.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2168	x.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 404 wrote to memory of 2168	404	WScript.exe	84
PID 404 wrote to memory of 2168	404	WScript.exe	84
PID 404 wrote to memory of 2168	404	WScript.exe	84
PID 2168 wrote to memory of 4500	2168	x.exe	95
PID 2168 wrote to memory of 4500	2168	x.exe	95
PID 2168 wrote to memory of 4500	2168	x.exe	95
PID 2168 wrote to memory of 4500	2168	x.exe	95
PID 2168 wrote to memory of 4500	2168	x.exe	95

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\fd5b1720cd537115d86f9043376e29c63122d2fb6ed1faabb2e272f966849370.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:404
- C:\Users\Admin\AppData\Local\Temp\x.exe
  "C:\Users\Admin\AppData\Local\Temp\x.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\x.exe
    "C:\Users\Admin\AppData\Local\Temp\x.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nstB5C4.tmp\System.dll
Size 12KB
SHA256 acf90ab6f4edc687e94aaf604d05e16e6cfb5e35873783b50c66f307a35c6506
MD5 6e55a6e7c3fdbd244042eb15cb1ec739
SHA1 070ea80e2192abc42f358d47b276990b5fa285a9
SHA512 2d504b74da38edc967e3859733a2a9cacd885db82f0ca69bfb66872e882707314c54238344d45945dc98bae85772aceef71a741787922d640627d3c8ae8f1c35
SSDEEP 192:MenY0qWTlt70IAj/lQ0sEWc/wtYbBH2aDybC7y+XBaIwL:M8+Qlt70Fj/lQRY/9VjjgL
MD5 SHA1 SHA512 SSDEEP

Submit Download

x.exe

Path C:\Users\Admin\AppData\Local\Temp\x.exe
Size 522KB
SHA256 544b62a05200bed200492c892d8d5c69022f1b57c5622b87e609834fee6cbe0f
MD5 e020f75bdaaa20d794d34f5be7516b7a
SHA1 b97e6bcd56d68dd78d6e6bc235559ab996548732
SHA512 0e0a7f259ad86abbd007e68a27ed7d833c730fc3a7ff8c07596708ba6450da58398856e9727c1880c258c9ef9273a1ef587294bc5203aebaa84ce8b39382171f
SSDEEP 12288:73Yv91vJA8pEq2VTa7Qk9T6R6W0DW/tip:73m91vJAUEDa7Qk56x0CFS
MD5 SHA1 SHA512 SSDEEP

Submit Download

Presignal.ini

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Presignal.ini
Size 37B
SHA256 794c596bc175a9d1f262a5ea46635ef8c7b978573b778d1e27d6f314bd8213ea
MD5 bcc33ee4aac4e80478c0906654fd5358
SHA1 1570a7279b02de69c0de6f330d81194ba1e515e6
SHA512 2e4ac8566a538f9a65a4ae1de65e1f70787c3525a7a9458dc4a321ddf4bdca0ea01a1f601fbf2ca1404c93aae534159d176ec0b0b57dd24a9d1ec5d825376ac4
MD5 SHA1 SHA512

Submit Download

memory/2168-30-0x0000000074DB5000-0x0000000074DB6000-memory.dmp

Download

memory/2168-27-0x0000000077911000-0x0000000077A31000-memory.dmp

Download

memory/2168-29-0x0000000002EC0000-0x0000000004924000-memory.dmp

Download

memory/2168-26-0x0000000002EC0000-0x0000000004924000-memory.dmp

Download

memory/2168-40-0x0000000002EC0000-0x0000000004924000-memory.dmp

Download

memory/4500-31-0x0000000000820000-0x0000000001A74000-memory.dmp

Download

memory/4500-38-0x0000000000820000-0x0000000001A74000-memory.dmp

Download

memory/4500-39-0x0000000000820000-0x0000000001A74000-memory.dmp

Download

memory/4500-41-0x0000000000820000-0x0000000001A74000-memory.dmp

Download

memory/4500-42-0x0000000000820000-0x0000000001A74000-memory.dmp

Download

memory/4500-45-0x0000000000820000-0x0000000001A74000-memory.dmp

Download